fix(sonarqube): reset to aligned 26.5.0 + CBP 26.5.0 on fresh data; DB→PG16

[emmanuelbruno]

Summary

One-off incident reset for the SonarQube "empty project list" regression. Restores a fully aligned 26.5.0 stack and pins the database to Postgres 16.

Root cause (established in the prior investigation): the server ran at the chart-default 26.7.0 while the Community Branch Plugin webapp + jar + javaagents were 26.5.0. SonarQube 26.7 changed component/project search to resolve documents by UUID with auth_ shadow docs; the 26.5.0 branch-plugin web layer resolves via the old path and returns an empty list (search_projects -> total: 15 but components: []). There is no 26.7.0 release of the plugin (latest is 26.5.0). The fix is to align the server down to 26.5.0 so server + plugin + webapp all match.

Changes (3 files)

1. helm/releases/sonarqube/values.yaml

Reconstructed from the pre-incident state (commit 0a68e71, the parent of PR #11) which carries the full 26.5.0 stack, then added an explicit server image pin:

• Added image: { repository: sonarqube, tag: 26.5.0.122743-community } — pins the SERVER to 26.5.0 (the chart default was 26.7.0.124771-community via community.buildNumber).
• Kept / restored: webapp-override init container (download-webapp -> 26.5.0 sonarqube-webapp.zip mounted over /opt/sonarqube/web), plugins.install (26.5.0 jar), both =ce/=web javaagents, jdbcOverwrite, SSO sonarProperties, persistence, mcp, account.adminPasswordSecretName.
• Removed (E1 leftovers): the cleanup-branch-plugin init container (it rm -f'd the plugin jar we are reinstalling) and the TEMP comment.

Net: server 26.5.0 + patched 26.5.0 webapp + 26.5.0 plugin jar + both 26.5.0 javaagents, fully aligned, no cleanup-init.

2. kubernetes/postgresql/sonarqube-db.yaml

• Added spec.image: ghcr.io/cloudnative-pg/postgresql:16.15-system-trixie (was: operator default PG 18.4). All other cluster spec unchanged (instances=1, db/owner app, backup to S3).

3. bootstrap/appset-helm.yaml

• Bumped the sonarqube valueURL cache-buster ?v=6 -> ?v=7 (ArgoCD caches remote valueFiles aggressively; without the bump it keeps rendering the old values). No other appset line changed.

Image tags (both verified pullable)

• SonarQube 26.5.0: sonarqube:26.5.0.122743-community — VERIFIED. Only 26.5.0 tag on Docker Hub library/sonarqube; digest sha256:223d0090…1fa, updated 2026-06-02. Same repo / no-registry-prefix convention as the live sonarqube:26.7.0.124771-community.
• CNPG Postgres 16: ghcr.io/cloudnative-pg/postgresql:16.15-system-trixie — VERIFIED pullable (manifest digest sha256:ac3bcd14…91b3); latest plain 16.x-system-trixie in the registry (16.16 absent). Matches the existing 18.4-system-trixie convention.

Validation (read-only)

• yq parse: all 3 files valid YAML.
• helm template (chart sonarqube 2026.4.1 + new values): renders 784 lines. Every sonarqube image = 26.5.0.122743-community (no 26.7.0 anywhere). download-webapp init present + /opt/sonarqube/web mount + webapp emptyDir(50Mi) volume. =ce/=web javaagents present in the sonar.properties ConfigMap (mounted to /opt/sonarqube/conf/) and install-plugins pulls the 26.5.0 jar. No cleanup-branch-plugin.
• CNPG manifest: spec.image = 16.15-system-trixie (yq-confirmed).

⚠️ CRITICAL OPERATIONAL NOTE — DB major-version downgrade (PG 18.4 -> 16.15)

This is a major Postgres downgrade. PostgreSQL cannot start an older major version on a data directory initialized by a newer one — PG 16 will refuse to start against the existing PG 18 data dir (control-file version too new).

Therefore, in the merge window the operator MUST delete the data PVCs so CNPG re-initializes fresh on PG 16:

• the sonarqube-db CNPG cluster data PVC (pod sonarqube-db-1), and
• the sonarqube-sonarqube SonarQube data PVC (ES + work data) — for a clean "fresh data" reset.

This is an operational action performed by the operator, NOT by this PR (this PR is GitOps config only; no live-cluster mutation). Deleting the PVCs wipes the SonarQube data (projects, issues, ES index) — a destructive reset, consistent with the "on fresh data" intent.

Suggested sequence to coordinate:

1. Merge this PR (ArgoCD syncs config; ?v=7 forces re-render).
2. Delete the sonarqube-db data PVC (CNPG re-creates the instance on PG 16) — or delete + re-create the Cluster if needed.
3. Delete the sonarqube-sonarqube data PVC so the server starts fresh (ES re-indexes from the new DB).
4. Verify: search_projects returns the 15 projects (now resolvable, since server == plugin == webapp == 26.5.0).

Risks / notes

• Data loss is intended (fresh reset). Backups to S3 s3://backups/sonarqube-db exist (14d retention) but a PG 18 dump is not directly restorable into a PG 16 instance; treat this as a true reset.
• CNPG 16.15 is the newest 16.x in the registry; PG 16 major is fully supported by CNPG operator 1.30.0 (the operator detects the major version from the image).
• Do NOT merge until the PVC-deletion window is coordinated with the team (brief outage).

[Copilot]

🟡 Changes recommended

The PostgreSQL image declaration may be ignored, preventing the intended PostgreSQL 16 reset.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR realigns SonarQube and its Community Branch Plugin to 26.5.0 and prepares a fresh PostgreSQL 16 reset.

Changes:

• Pins SonarQube and plugin components to 26.5.0.
• Attempts to configure PostgreSQL 16.15.
• Bumps the ArgoCD values cache-buster.

File summaries

File	Summary
kubernetes/postgresql/sonarqube-db.yaml	The CNPG image field should use imageName; the current image field may be ignored (critical, 3 votes). Documentation also contradicts the PostgreSQL 16 exception (nit, 1 vote).
helm/releases/sonarqube/values.yaml	Aligns the SonarQube server, webapp, plugin, and Java agents to 26.5.0.
bootstrap/appset-helm.yaml	Updates the values cache-buster from v=6 to v=7.

Review details

Suppressed comments (2)

kubernetes/postgresql/sonarqube-db.yaml:8

• After correcting the field to imageName, this image-only change still will not be reconciled automatically: bootstrap/app-postgresql.yaml:41-53 ignores .spec.imageName, and that Application uses ApplyOutOfSyncOnly. The Cluster will therefore remain considered in sync and keep the current/default PostgreSQL major version; remove this ignore for the migration or otherwise force this field to be applied as part of the reset.

  image: ghcr.io/cloudnative-pg/postgresql:16.15-system-trixie

kubernetes/postgresql/sonarqube-db.yaml:8

• This introduces a repository-wide documentation contradiction: AGENTS.md:92 and docs/cluster.md:233 state that every CNPG cluster pins 18.4-system-trixie. Update those operational references or document the SonarQube PostgreSQL 16 exception so future recovery and upgrade work does not follow stale guidance.

  image: ghcr.io/cloudnative-pg/postgresql:16.15-system-trixie

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.